From: Eli Zaretskii <eliz@gnu.org>
To: charles@aurox.ch (Charles A. Roelli)
Cc: 28350@debbugs.gnu.org
Subject: bug#28350: enriched.el code execution
Date: Sat, 09 Sep 2017 16:45:40 +0300 [thread overview]
Message-ID: <838thovvcr.fsf@gnu.org> (raw)
In-Reply-To: <m2a8249i1x.fsf@aurox.ch> (charles@aurox.ch)
> Date: Sat, 09 Sep 2017 14:23:54 +0200
> From: charles@aurox.ch (Charles A. Roelli)
> CC: 28350@debbugs.gnu.org
>
> Thank you. Does the attached patch look OK? I've used the file
> enriched-test-safe-props.txt (also attached) to test that safe
> properties are still applied.
Thank you for working on this. I have some comments:
> --- a/lisp/textmodes/enriched.el
> +++ b/lisp/textmodes/enriched.el
> @@ -503,6 +503,47 @@ enriched-decode-display-prop
> (error nil)))))
> (unless prop
> (message "Warning: invalid <x-display> parameter %s" param))
> - (list start end 'display prop)))
> + (if (enriched-display-prop-safe-p prop)
> + (list start end 'display prop)
> + (message "Warning: unsafe <x-display> parameter %s not applied" param)
> + (list start end))))
I think we will want to allow unsafe display properties, given a
user's explicit permission. So I think we need a defcustom that
allows this, and then enriched-display-prop-safe-p should always
return non-nil.
> +See Info node `(elisp)Display Property' for the use of these
> +display specifications."
> + (ignore-errors
> + (or (stringp prop)
^^^^^^^^^^^^
What about an image spec (including a slice spec)?
> + (and (eq (car prop) 'space-width)
> + (or (integerp (cadr prop)) (floatp (cadr prop))))
> + (and (consp (car prop))
> + (eq (caar prop) 'margin)
> + (or (eq (cadar prop) 'right-margin)
> + (eq (cadar prop) 'left-margin))
> + (stringp (cadr prop)))
The margin display can also specify an image, not just a string, and I
think that would be safe as well.
> + (and (eq (car prop) 'height)
> + (or (integerp (cadr prop))
> + (and (listp (cadr prop))
> + (or (eq (elt (cadr prop) 0) '+) (elt (cadr prop) 0) '-)
> + (integerp (elt (cadr prop) 1)))))
^^^^^^^^
I think this should be numberp, as the value could also safely be a
float.
> + (and (eq (car prop) 'raise)
> + (integerp (cadr prop))))))
^^^^^^^^
The FACTOR in (raise FACTOR) can also be a float, so I think numberp
is the correct predicate here.
And then what about (space . PROPS) type of display spec? I think all
of its variants are safe.
next prev parent reply other threads:[~2017-09-09 13:45 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-04 19:24 bug#28350: enriched.el code execution Charles A. Roelli
2017-09-06 19:25 ` Charles A. Roelli
2017-09-07 2:34 ` Eli Zaretskii
2017-09-09 12:23 ` Charles A. Roelli
2017-09-09 13:45 ` Eli Zaretskii [this message]
2017-09-09 15:57 ` Charles A. Roelli
2017-09-09 16:55 ` Eli Zaretskii
2017-09-09 20:37 ` Charles A. Roelli
2017-09-10 17:01 ` Eli Zaretskii
2017-09-11 16:32 ` Glenn Morris
2017-09-11 17:01 ` Eli Zaretskii
2017-09-09 22:43 ` Paul Eggert
2017-09-10 18:54 ` Charles A. Roelli
2017-09-10 21:46 ` Paul Eggert
2017-09-11 2:39 ` Eli Zaretskii
2017-09-11 14:22 ` Eli Zaretskii
2017-09-11 15:18 ` Eli Zaretskii
2017-09-11 18:44 ` Charles A. Roelli
2017-09-11 19:07 ` Eli Zaretskii
2017-09-16 9:48 ` Eli Zaretskii
2017-09-11 15:33 ` Glenn Morris
2017-09-11 16:38 ` Paul Eggert
2017-09-11 21:16 ` Glenn Morris
2017-09-12 19:59 ` Paul Eggert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=838thovvcr.fsf@gnu.org \
--to=eliz@gnu.org \
--cc=28350@debbugs.gnu.org \
--cc=charles@aurox.ch \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.